The sandbox user-authentication API identified a payer from an email address or from a payment id, plus the public client id. The response included a user id and masked email and phone.
The next call was the one-time-code check for the "remember me" step. Any six-digit code was accepted. The response was a valid id token for that payer, plus the unmasked email and phone.
What we proved
Identify, then authenticate with a code that was not the one sent to the payer. The token was issued. Wrong-shape input was rejected, so this was not "the endpoint ignores the body."
What this is not
Not a production payer. The host was the sandbox authentication API. We do not claim production money movement. A sandbox login that accepts every code is still the flow integrators copy, and it discloses the full contact fields of sandbox users.
Why a scanner misses it
A login form that "sends a code" looks like MFA. The bug is that the verify step does not check the code. Tools that stop at "OTP field exists" mark it passed.
Buyer takeaway: Treat the sandbox auth host as production auth. A remember-me code that is not checked is a password made of six digits, and then not even those.
